Password Generator
Generate strong, cryptographically random passwords in your browser. Customise length, character sets, and quantity. Your passwords never leave this tab.
Password Generator
Runs entirely in your browser — no server calls, no tracking.
Click Generate passwords to begin.
🔒 Your data never leaves this tab. This tool has no backend.
About the Password Generator
This tool generates passwords using crypto.getRandomValues() — the browser's cryptographically secure pseudo-random number generator. It is the same entropy source used by password managers and security tools. The passwords are generated entirely in your browser; they are never transmitted, logged, or stored anywhere.
What makes a password strong?
Password strength is measured in bits of entropy. An 8-character password using all four character sets (95 printable ASCII characters) has log₂(95⁸) ≈ 52 bits of entropy — weak by modern standards. A 20-character password with the same character set has ≈131 bits — extremely strong. Length matters far more than complexity. A 20-character lowercase-only password is significantly stronger than an 8-character mixed-case password.
How to use generated passwords
Use a password manager (Bitwarden, 1Password, KeePass) to store generated passwords — never write them down or reuse them. For service accounts and API keys, prefer passwords of 32+ characters. For user-facing resets, 16–20 characters with all character sets is a good balance between strength and usability in most UI flows.
For systems that reject special characters, uncheck Symbols to generate an alphanumeric-only password. The tool recalculates immediately when you change options, so you can preview the character set before generating.
What actually makes the strongest password
“Strongest” has a precise meaning here, and it is not the one most people assume. Strength comes from entropy — the number of guesses an attacker would need — and entropy comes overwhelmingly from length, not from exotic characters.
| Password | Length | Rough entropy |
|---|---|---|
| P@ssw0rd! | 9 | ~28 bits — broken instantly |
| Random, mixed character set | 12 | ~78 bits — strong |
| Random, mixed character set | 16 | ~104 bits — very strong |
| Four random words | ~24 | ~52 bits — strong and memorable |
Adding one character to a random password multiplies the search space by the size of the character set. Substituting 0 for o multiplies it by roughly nothing, because every cracking tool tries those substitutions first.
12 characters or 16?
A 12 character password generator produces something no current attacker will brute-force. A 16 character password generator gives you comfortable margin for the next decade and is the sensible default for anything holding money, email, or other people's data. Use 16 or more for your password manager's master password and your email account — those two unlock everything else.
Random characters or random words?
Both work. Random character strings pack more entropy per character but must live in a password manager. A passphrase of four or five genuinely random words is far easier to type on a phone or read aloud, at the cost of length. The only bad option is anything you invented yourself from memorable facts.
Why generated beats invented
Humans are poor random number generators. We favour certain letters, put digits at the end, and capitalise the first character — and cracking tools model all of it. A generated password is drawn from your browser's cryptographic random source, which has none of those habits. Every password on this page is generated locally and never leaves your device.
Frequently asked questions
Maximum length with all character types enabled. Length dominates everything else: a 16-character random password has roughly 104 bits of entropy versus about 78 bits at 12 characters. Use 16 or more for your email, banking and password manager master password; 12 or more is fine elsewhere.
Yes for most accounts, provided it is genuinely random rather than invented. A random 12-character password using upper case, lower case, digits and symbols is not brute-forceable with current hardware. Step up to 16 characters for email, financial accounts and your password manager, since those unlock everything else.
They are a good trade-off rather than a strict improvement. Four random words give around 52 bits of entropy — strong, and far easier to type on a phone or read aloud. A random 16-character string gives roughly twice that, but you will need a password manager to use it. Both beat anything you invent yourself.
Barely. Substitutions like 0 for o or @ for a are the first thing cracking tools try, so P@ssw0rd is only marginally harder than password. Adding length is what actually helps — each extra character multiplies the number of guesses required.
Yes. Passwords are generated in your browser using the built-in cryptographic random source, and nothing is transmitted, logged or stored on any server. You can disconnect from the internet and the tool still works.
crypto.getRandomValues() is a CSPRNG — the same underlying entropy source used by TLS key generation and OS-level random number generation. It is safe for generating passwords. The risk is not generation quality but storage: always use a password manager rather than writing generated passwords down.Math.random()) is seeded from a predictable state and produces predictable sequences if the seed is known. A CSPRNG like crypto.getRandomValues() uses hardware entropy sources (CPU timing jitter, OS entropy pools) to produce values that cannot be predicted even with knowledge of previous outputs. Always use CSPRNG for security-sensitive generation.Need secure authentication built for your app?
ruxox builds production-grade auth systems, API security, and access control. Free scoping estimate in 48 hours.